Skip to content
Snippets Groups Projects
Unverified Commit 755d27bb authored by Arthur Silva Sens's avatar Arthur Silva Sens Committed by GitHub
Browse files

Merge pull request #1610 from ArthurSens/as/linux-hardening

Drop Linux capabilities
parents 21e26c80 931af324
No related branches found
No related tags found
No related merge requests found
Showing
with 58 additions and 2 deletions
......@@ -66,7 +66,7 @@ kubeconform: crdschemas manifests $(KUBECONFORM_BIN)
.PHONY: kubescape
kubescape: $(KUBESCAPE_BIN) ## Runs a security analysis on generated manifests - failing if risk score is above threshold percentage 't'
$(KUBESCAPE_BIN) scan -s framework -t 20 nsa manifests/*.yaml --exceptions 'kubescape-exceptions.json'
$(KUBESCAPE_BIN) scan -s framework -t 16 nsa manifests/*.yaml --exceptions 'kubescape-exceptions.json'
.PHONY: fmt
fmt: $(JSONNETFMT_BIN)
......
......@@ -175,6 +175,7 @@ function(params) {
runAsUser: 65534,
allowPrivilegeEscalation: false,
readOnlyRootFilesystem: true,
capabilities: { drop: ['ALL'] },
},
volumeMounts: [{
mountPath: '/etc/blackbox_exporter/',
......@@ -196,6 +197,7 @@ function(params) {
runAsUser: 65534,
allowPrivilegeEscalation: false,
readOnlyRootFilesystem: true,
capabilities: { drop: ['ALL'] },
},
terminationMessagePath: '/dev/termination-log',
terminationMessagePolicy: 'FallbackToLogsOnError',
......
......@@ -87,6 +87,7 @@ function(params)
// FIXME(ArthurSens): The securityContext overrides can be removed after some PRs get merged
// 'allowPrivilegeEscalation: false' can be deleted when https://github.com/brancz/kubernetes-grafana/pull/128 gets merged.
// 'readOnlyRootFilesystem: true' can be deleted when https://github.com/brancz/kubernetes-grafana/pull/129 gets merged.
// 'capabilities: { drop: ['ALL'] }' can be deleted when https://github.com/brancz/kubernetes-grafana/pull/130 gets merged.
deployment+: {
spec+: {
template+: {
......@@ -95,6 +96,7 @@ function(params)
securityContext+: {
allowPrivilegeEscalation: false,
readOnlyRootFilesystem: true,
capabilities: { drop: ['ALL'] },
},
}, super.containers),
},
......
......@@ -63,5 +63,6 @@ function(params) {
runAsNonRoot: true,
allowPrivilegeEscalation: false,
readOnlyRootFilesystem: true,
capabilities: { drop: ['ALL'] },
},
}
......@@ -118,6 +118,8 @@ function(params) (import 'github.com/kubernetes/kube-state-metrics/jsonnet/kube-
image: ksm._config.kubeRbacProxyImage,
}),
// FIXME(ArthurSens): The securityContext overrides can be removed after some PRs get merged
// 'capabilities: { drop: ['ALL'] },' can be deleted when https://github.com/kubernetes/kube-state-metrics/pull/1674 gets merged.
deployment+: {
spec+: {
template+: {
......@@ -133,6 +135,9 @@ function(params) (import 'github.com/kubernetes/kube-state-metrics/jsonnet/kube-
readinessProbe:: null,
args: ['--host=127.0.0.1', '--port=8081', '--telemetry-host=127.0.0.1', '--telemetry-port=8082'],
resources: ksm._config.resources,
securityContext+: {
capabilities: { drop: ['ALL'] },
},
}, super.containers) + [kubeRbacProxyMain, kubeRbacProxySelf],
},
},
......
......@@ -184,6 +184,7 @@ function(params) {
securityContext: {
allowPrivilegeEscalation: false,
readOnlyRootFilesystem: true,
capabilities: { drop: ['ALL'], add: ['CAP_SYS_TIME'] },
},
};
......
......@@ -229,6 +229,7 @@ function(params) {
securityContext: {
allowPrivilegeEscalation: false,
readOnlyRootFilesystem: true,
capabilities: { drop: ['ALL'] },
},
};
......
......@@ -125,11 +125,17 @@ function(params)
image: po._config.kubeRbacProxyImage,
}),
// FIXME(ArthurSens): The securityContext overrides can be removed after some PRs get merged
// 'capabilities: { drop: ['ALL'] },' can be deleted when https://github.com/prometheus-operator/prometheus-operator/pull/4546 gets merged.
deployment+: {
spec+: {
template+: {
spec+: {
containers+: [kubeRbacProxy],
containers: std.map(function(c) c {
securityContext+: {
capabilities: { drop: ['ALL'] },
},
}, super.containers) + [kubeRbacProxy],
},
},
},
......
......@@ -43,6 +43,9 @@ spec:
memory: 20Mi
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 65534
......@@ -64,6 +67,9 @@ spec:
memory: 20Mi
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 65534
......@@ -92,6 +98,9 @@ spec:
memory: 20Mi
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
runAsGroup: 65532
runAsNonRoot: true
......
......@@ -47,6 +47,9 @@ spec:
memory: 100Mi
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
volumeMounts:
- mountPath: /var/lib/grafana
......
......@@ -43,6 +43,9 @@ spec:
memory: 190Mi
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
runAsUser: 65534
- args:
......@@ -64,6 +67,9 @@ spec:
memory: 20Mi
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
runAsGroup: 65532
runAsNonRoot: true
......@@ -87,6 +93,9 @@ spec:
memory: 20Mi
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
runAsGroup: 65532
runAsNonRoot: true
......
......@@ -45,6 +45,11 @@ spec:
memory: 180Mi
securityContext:
allowPrivilegeEscalation: false
capabilities:
add:
- CAP_SYS_TIME
drop:
- ALL
readOnlyRootFilesystem: true
volumeMounts:
- mountPath: /host/sys
......@@ -80,6 +85,9 @@ spec:
memory: 20Mi
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
runAsGroup: 65532
runAsNonRoot: true
......
......@@ -49,6 +49,9 @@ spec:
memory: 180Mi
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
volumeMounts:
- mountPath: /tmp
......
......@@ -44,6 +44,9 @@ spec:
memory: 100Mi
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
- args:
- --logtostderr
......@@ -64,6 +67,9 @@ spec:
memory: 20Mi
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
runAsGroup: 65532
runAsNonRoot: true
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment